Google's IP anonymization fails to anonymize

Found on The Register on Thursday, 11 September 2008
Browse Internet

More than a year ago, the company said it would "anonymize" its server logs after eighteen months. And sometime between March and July, it actually put this plan into action.

In this case, anonymize meant "change some of the bits in the IP address in the logs as well as change the cookie information."

But as CNet points out, if your cookie data remains intact, restoring the full IP address is trivial.

Google argues that users can always delete their cookies. "We have focused on IP addresses, because we recognize that users cannot control IP addresses in logs," the company says. "On the other hand, users can control their cookies.

"When a user clears cookies, s/he will effectively break any link between the cleared cookie and our raw IP logs once those logs hit the 9-month anonymization point. Moreover, we are still continuing to focus on ways to help users exert better controls over their cookies."

Whoever honestly believed that Google would anonymize any of the data it collected needs to be beaten with a heavy blunt object. The comments comming from the Googleplex make it pretty obvious: they want your data more than anything else; and thinking that the same guys will delete it is just an illusion. So, reject their cookies and choose an ISP which assigns dynamic IP addresses.